Earlier today, CMS unveiled the final rule on Section 111 civil money penalties (CMP). The final rule substantially modifies the February 2020 proposed rule by eliminating potential penalties associated with poor quality reporting and “contradictory” reporting, and instead focusing on outright failure of responsible reporting entities (RREs) to timely report required information to Medicare.
CMS also announced a monitoring framework that largely relies upon individual claim audits, and revised penalties notices and calculations that allow RREs to present mitigating information to avoid penalties. Make no mistake, the potential for penalties is still significant and RREs should be prepared to timely, completely, accurately report claim data to Medicare in order to avoid penalties. Here’s the critical information that you need to know about the final rule.
Timeline and Statute of Limitations
While the final rule is effective 60 days post publication on December 11, 2023, it is applicable one year after publication on October 10, 2024. The final rule is prospective in nature and there is a five-year statute of limitations from the date of the instance of noncompliance.
What’s in the Rule?
In its own words, CMS will “only impose penalties where the initial report was not received in a timely manner.” Noncompliance is defined as “any time CMS identifies a new beneficiary record that was not reported to CMS timely.” Timeliness is defined as “reporting to CMS within 1 year of… the date a settlement, judgment, award, or other payment determination was made (or the funding of a settlement, judgment, award, or other payment, if delayed), or the date when an entity’s Ongoing Responsibility for Medicals (ORM) became effective.” Of note, CMS chose to focus its definition of noncompliance solely as noted above, which means untimely termination of ORM coverage is not a basis for imposition of CMPs under this rule.
CMS will use a tiered approach when imposing penalties and will utilize an audit approach (specifics on these below) to identify possible penalties. While there is a formal appeals process, CMS committed to an informal notice provision, and a 30-day period for RREs to respond in order to share their “good faith efforts,” or to “clarify, mitigate, or explain any errors that were the result of a technical issue or due to an error or system issue caused by CMS or its contractors[,]”
Safe Harbors
The final rule contains the following safe harbors:
- Any untimely reporting that is the result of a technical or system issue outside of the control of the RRE, or that is the result of an error caused by CMS or one of its contractors would not be considered noncompliance for purposes of this rule.
- Any untimely reporting by an NGHP that is the result of a failure to acquire all necessary reporting information due to a lack of cooperation by the beneficiary will not lead to a CMP provided that certain standards are met (i.e. there is documentation of “good faith efforts” to obtain the information). NGHP RREs good faith efforts must include making a total of three attempts to obtain the information required for reporting.
CMS codified what ECS has referred to as the “2 and 1” rule: at least two of the attempts to the individual and their attorney must be via mail or electronic mail, and the third attempt may be via telephone, electronic mail or “some other reasonable method.”
CMS also expanded the final rule to indicate that “should an individual or their attorney or representative clearly and unambiguously decline to provide the information requested, no further attempts by the RRE to obtain the required information would be required.”
The documented attempts and any declination by the individual or their attorney must be maintained for a minimum of 5 years.
Outside these two safe harbors, CMS acknowledged there may exist other situations where it is inappropriate to penalize an RRE for noncompliance. CMS encourages RREs to utilize the informal or formal appeal process in those situations.
CMS Audit
Per the final rule, the audit will consist of “a randomized sample of new beneficiary records received each quarter, rather than undertaking an automated review of all records submitted.” CMS provided a detailed outline of the proportionate methodology they plan to use based on a pro-rata count of recently added NGHP and GHP records over a calendar quarter under evaluation in the final rule.
“At the end of each calendar quarter, CMS will randomly select the indicated number of records and analyze each selected record to determine if it is in compliance with the reporting requirements. For NGHP entities, for any selected record determined to be noncompliant, a tiered approach to penalties will be implemented.” “To calculate the penalty imposed against an RRE, CMS will multiply the number of audited records found to be noncompliant by the number of days that each record was late (in excess of 365 days). The product will then be multiplied by the appropriate penalty amount.” CMS claims this approach to enforcement means smaller entities are inherently much less likely to have their records audited for compliance.
Tiered Approach to the Calculation of NGHP Penalties
Due to the critical work of NGHP stakeholders and specifically the MARC Coalition, the $1,000 per day per claim penalty is permissive for NGHPs as opposed to mandatory for GHPs. Since CMS is permitted discretion in the amount of the CMP on NGHP files, they opted for a tiered approach “based upon the length of time for which a submission was untimely to better align the penalty to the severity of the noncompliance.”
The calendar day penalty for an NGHP record selected via the random audit process where the NGHP RRE is found to be noncompliant (i.e. ORM Y or TPOC information was reported more than 1 year late) is as follows:
- $250* where the record was reported 1 year or more, but less than 2 years after, the required reporting date;
- $500* where the record was reported 2 years or more, but less than 3 years after, the required reporting date; or
- $1,000* where the record was reported 3 years or more after the required reporting date.
- The total penalty for any one instance of noncompliance by an NGHP RRE for a given record identified by CMS will be no greater than $365,000.*
(* as adjusted annually under 45 CFR part 102)
Formal Appeals
Once formal written notice of the CMP is received by an RRE, they will have the right to request a hearing with an Administrative Law Judge (ALJ) within 60 calendar days of receipt. Any party may appeal the initial decision of the ALJ to the Departmental Appeals Board (DAB) within 30 calendar days. The DAB’s decision becomes binding 60 calendar days following service of the DAB’s decision, absent petition for judicial review.
What is no longer under consideration?
In its announcement, CMS took care to explain that it was focused almost exclusively on the desire to “motivate proper reporting and maintain compliance with the existing statute and regulations,” rather than merely punish otherwise well-intentioned RREs. CMS listened to public comments, including ECS’ that criticized several elements of the original proposal, particularly the concept of “contradictory information.” There are a number of elements of the original proposal that are on the cutting-room floor, most notably (1) the idea that an RRE could be penalized for information uncovered during the recovery process (so, outside of Section 111 reporting) and (2) the concept of penalizing an RRE who fails to report accurate information over an eight quarter window.
The concept of contradictory information suggested that RREs could face a lose-lose situation, wherein they would be force to choose between appealing a conditional payment demand and notifying Medicare that information was not timely reported and risking a penalty. Alternatively, the RRE could file the appeal and be penalized. CMS eliminated this concept entirely.
CMS also eliminated the concept of “messy” reporting penalties. With so many RREs and agents only reporting accurate information, and withholding data that would result in an error; and with CMS adopting a concept of “soft errors” shortly after the release of the proposed rule, the concept of “messy” reporting seems obsolete and CMS elected to scrap it entirely.
What is the bottom line?
CMS has elected to pursue penalties only where parties substantially delay notifying the agency of primary payer “responsibility” as defined in the regulations. “Responsibility” as defined by CMS is payment “to or on behalf of” a Medicare beneficiary. So if a primary payment situation exists and CMS is not timely notified of it, then a potential penalty arises.
CMS is giving RREs a lot of time to get their reporting correct. However, in giving a lot of time, one can be sure that a failure to report timely will be met with some level of a penalty. CMS is not going to simply cut an RRE slack because they did their best. The intent behind these penalties, much like speeding tickets, is to encourage best behavior.
Without delay, RREs need to engage in accurate, complete, and timely (ACT) reporting. What does that entail? That means:
- Register with CMS to report if you haven’t yet done so. This many seem obvious, but we regularly communicate with RREs who remain unaware of their obligation to report.
- Ensure RRE contact and TIN (tax identification number) information is up-to-date in your CMS file – don’t let a technical error put you at risk.
- Work with well trained staff internally or our experts to execute your ACT reporting.
- Leverage technology to assist you internally or here at ECS.
- Monitor and audit your internal processes and procedures or that of your third party
Where do we go from here?
No doubt, you will hear a lot in the coming days about Section 111 civil money penalties. How do you separate fact from fiction, rumor from reality, and prepare your organization for these important regulations? On Friday October 13th at 2 PM ET / 11 AM PT ECS will provide a webinar, outlining the penalties, what RREs need to know about them, and how you can prepare your organization today for a well-regulated penalty. To register for this important webinar, go here.
If you are not already an ECS customer and you are concerned about your organizational exposure, ECS is here for you. ECS successfully reports on behalf of thousands of RREs, works with every major claims system, and has a huge team of skilled professionals that can swiftly help you identify and mitigate your risks. Call us at 781-517-8085 or email us today at ComplianceHotline@ExamWorksCompliance.com to get started today.
